Password reset does not stop access if valid MFA token

Robert Cook 1

Using MFA Server with ADFS Adapter

If a MFA enabled user changes their password, email is still accessible on phone without having to change password, assuming until token expires.

I have read with Azure AD the refresh token would require the device to re-authenticate, I cant see an option to achieve this using MFA Server & ADFS.

Is this possible?

VipulSparsh-MSFT 16,296 Reputation points Microsoft Employee

2020-06-12T05:36:50.14+00:00

@Robert Cook If the solution provided by Tkujala helped you, please "Mark as Answer" and "Up-Vote" for the answer that helped you for benefit of the community.

1 answer

T. Kujala 8,741 Reputation points

2020-06-09T17:24:57.983+00:00

Yes, it is possible.

Here you will find more information how to configure token lifetimes.

https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes
Please sign in to rate this answer.
Saurabh Sharma 23,826 Reputation points Microsoft Employee

2020-06-12T21:00:35.917+00:00

@Robert Cook Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Password reset does not stop access if valid MFA token

1 answer

Your answer